Top stories
- PHP2Shell: AI uncovers critical RCE in PHP
Story · 1 report
PHP2Shell: AI uncovers critical RCE in PHP
Wiz Research disclosed PHP2Shell, a set of core PHP memory-safety vulnerabilities that can enable unauthenticated remote code execution or disclosure of sensitive process memory on affected servers. PHP released patches on October 21, 2026, for flaws tracked as CVE-2026-109618 and CVE-2026-109619, with reported severity up to CVSS 9.2. Wiz said every PHP release dating to version 5.4 is affected by at least one issue and urged immediate patching. PHP powers WordPress, Drupal, Joomla, MediaWiki and other widely deployed web software. The flaws involve stale internal state left after fatal errors, particularly out-of-memory conditions, allowing later requests handled by the same worker to access or corrupt reused memory. Wiz demonstrated pre-authentication remote code execution against current container images of WordPress, Drupal and Joomla, while emphasizing that exploitation occurs in PHP itself and does not require an application-level vulnerability. It also demonstrated disclosure of passwords, tokens, API keys and other data from PHP worker memory. Wiz combined the issues in an exploit script called php2shell and said it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol to discover flaws, develop exploits, validate patches and create detections. The company coordinated disclosure and mitigations with PHP, OpenAI, Calif, cloud providers, CDNs and hosting-related companies.
wiz.io
🔥🔥🔥🔥🔥13 min
7h ago
No more articles to load